|
Time |
Victim OS |
Infection Source |
C&C Server |
DNS Lookups & Failed Connects |
Infection Port |
Packet Trace |
Detection Signatures |
Infection Chatter |
BotHunter Analysis |
Behavioral Cluster |
Forensic Logs |
Antivirus Labels |
Packed Malware_Binary |
Unpacked egg.exe |
Unpacked egg.asm |
Packer PEID |
Data Strings |
Syscall Trace |
| T:00:28:00 | Win2K-f | 209.204.73.200 (SNIPARPA.NET): SNIP, PHILADELPHIA, PENNSYLVANIA, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 76 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 |
53bfe15e91 NEW 73f1082158 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:03:02:00 | Win2K-f | 175.112.144.73 (-): . |
60.190.222.139:65520 | CN:proxima.ircgalaxy.pl US:microsoft.com CN:av.lometr.pl CN:file0129.iwillhavesexygirls.com EU:pozeml.com EU:img.ub8.net :xz.ub9.net :in.7cy.net :redirect.hotkeys.com US:searchportal.information.com US:spi.domainsponsor.com :chessgamesplay.com CN:122.224.6.48:88 US:204.13.161.51:80 EU:91.206.201.39:80 EU:91.214.44.12:80 |
135 | pcap | raw alerts ruleset |
irc http 173 lines |
Yeah : 1.8 profile |
none | summary tarball |
29 of 39 26 of 42 39 of 41 16 of 42 31 of 33 |
4691ac4856 NEW 7327b9e4a0 NEW ab9c4b5f21 NEW c5023ffbda NEW d789c8d157 NEW |
none[none] none [none] 5fe48b2dcc[0] none [none] 5f6572479f[0] |
none:none none:none none:none none:none none:none |
none|none none|none Armadillo| none|none PolyEnE| |
none none none none none |
none none trace none trace |
| T:03:32:00 | Win2K-f | 122.49.241.179 (CCNET-AI.NE.JP): COMMUNITY NETWORK CENTER INC, TOYOKAWA, AICHI, JP. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
0 of 32 33 of 33 |
07fabc79ef NEW 53bfe15e91 NEW |
none[0] 1473091351[0] |
ASM:Graph ASM:Graph |
Armadillo| tElock| |
lines=81 lines=75 embedded dns |
trace trace |
| 05:56:00 | Win2K-f | 183.31.134.90 (-): . |
n/a | US:www.maxmind.com EU:getmyip.co.uk GB:www.vouchercodez.com :checkip.dyndns.org US:www.getmyip.org DE:131.220.6.26:80 208.78.70.70:80 US:75.126.138.202:80 GB:80.82.121.239:80 |
445 | pcap | raw alerts ruleset |
http 5 lines |
Yeah : 0.8 profile |
none | summary tarball |
2 of 37 | 223d8089f8 NEW |
none[3] | none:none |
StarForce| | none | trace |
| T:06:05:00 | Win2K-f | 183.31.134.90 (-): . |
n/a | US:www.maxmind.com US:www.getmyip.org EU:getmyip.co.uk GB:www.vouchercodez.com :checkip.dyndns.org DE:131.220.6.26:80 208.78.70.70:80 GB:80.82.121.239:80 |
445 | pcap | raw alerts ruleset |
http 6 lines |
Yeah : 0.8 profile |
none | summary tarball |
2 of 37 | 223d8089f8 NEW |
none[3] | none:none |
StarForce| | none | trace |
| T:06:33:00 | WinXP | 114.137.153.49 (HINET.NET): MOBILE BUSINESS GROUP CHUNGHWA TELECOM CO. LTD, TAIPEI, T'AI-PEI, TW. (DSL) |
n/a | 445 | pcap | raw alerts ruleset |
shell ftp 14 lines |
Yeah : 1.3 profile |
none | summary tarball |
37 of 40 | 5285741560 NEW |
60590b8b67 [0] | ASM:Graph |
none|none | lines=59 | trace | |
| 06:46:00 | Win2K-f | 122.229.164.46 (HZ.ZJ.CN): CHINANET-ZJ ZHONGXIN NODE NETWORK, BEIJING, BEIJING, CN. (DSL) |
n/a | US:www.maxmind.com :checkip.dyndns.org EU:getmyip.co.uk GB:www.vouchercodez.com US:www.getmyip.org DE:131.220.6.26:80 208.78.70.70:80 US:75.126.138.202:80 GB:80.82.121.239:80 |
445 | pcap | raw alerts ruleset |
http 5 lines |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
| T:06:54:00 | Win2K-f | 122.229.164.46 (HZ.ZJ.CN): CHINANET-ZJ ZHONGXIN NODE NETWORK, BEIJING, BEIJING, CN. (DSL) |
n/a | US:www.maxmind.com EU:getmyip.co.uk GB:www.vouchercodez.com :checkip.dyndns.org US:www.getmyip.org DE:131.220.6.26:80 208.78.70.70:80 GB:80.82.121.239:80 |
445 | pcap | raw alerts ruleset |
http 6 lines |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
| T:07:29:00 | Win2K-f | 125.4.3.49 (ZAQ.NE.JP): J:COM WEST CO. LTD, OSAKA, OSAKA, JP. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
0 of 32 33 of 33 |
07fabc79ef NEW 53bfe15e91 NEW |
none[0] 1473091351[0] |
ASM:Graph ASM:Graph |
Armadillo| tElock| |
lines=81 lines=75 embedded dns |
trace trace |
| 11:24:00 | WinXP | 62.215.47.77 (-): FAST TELCO INFRA STRUCTURE WEB ACCESS USERS, KUWAIT, AL KUWAYT, KW. (DSL) |
213.219.245.212:80 | RU:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 1.3 profile |
none | summary tarball |
26 of 28 | 7d99b0e910 NEW |
none[0] | none:none |
PolyEnE| | lines=68 | trace |
| T:12:11:00 | WinXP | 186.9.87.104 (IMOVIL.ENTELPCS.CL): ENTEL PCS TELECOMUNICACIONES S.A, SANTIAGO, REGION METROPOLITANA, CL. (DSL) |
n/a | RU:citi-bank.ru RU:213.219.245.212:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
41 of 42 | cf6b76a438 NEW |
none[none] | none:none |
none|none | none | none |
| T:16:13:00 | Win2K-f | 98.141.9.117 (CAVTEL.NET): CAVALIER TELEPHONE, VIRGINIA BEACH, VIRGINIA, US. (DSL) |
n/a | 135 | pcap | raw alerts ruleset |
other 18 lines |
Yeah : 1.3 profile |
none | summary tarball |
none | none | none | none | none | none | none | |
| T:18:16:00 | WinXP | 4.189.59.177 (LEVEL3.NET): LEVEL 3 COMMUNICATIONS INC, ROCKPORT, TEXAS, US. (DSL) |
n/a | 135 | pcap | raw alerts ruleset |
other 5 lines |
Yeah : 0.8 profile |
none | summary tarball |
none | none | none | none | none | none | none | |
| T:18:19:00 | Win2K-f | 70.184.102.222 (COX.NET): COX COMMUNICATIONS, PHOENIX, ARIZONA, US. (100Mbps) |
83.133.119.206:65520 | CN:proxim.ircgalaxy.pl US:microsoft.com :pozemle.cn CN:file0129.iwillhavesexygirls.com EU:pozeml.com US:bfkq.com :jsactivity.com EU:img.ub8.net :www.backblogs.com US:64.191.44.8:80 DE:83.133.119.206:65520 EU:91.206.201.39:80 93.174.92.220:80 |
135 | pcap | raw alerts ruleset |
irc http 222 lines |
Yeah : 1.8 profile |
none | summary tarball |
15 of 42 29 of 39 0 of 42 3 of 42 32 of 36 16 of 42 26 of 42 35 of 36 |
2267624c0f NEW 4691ac4856 NEW 9c88ce0440 NEW b955d66ba6 NEW bea8cb1865 NEW c5023ffbda NEW efdad390ed NEW fac78fde16 NEW |
none[none] none [none] none [none] none [none] 154de51a66[0] none [none] none [none] 882896ab05[0] |
none:none none:none none:none none:none ASM:Graph none:none none:none none:none |
none|none none|none none|none none|none Armadillo| none|none none|none tElock| |
none none none none lines=91 none none none |
none none none none trace none none trace |
| T:18:46:00 | Win2K-f | 120.74.214.205 (JWS.COM): SO-NET ENTERTAINMENT CORPORATION, CHIBA, CHIBA, JP. (DSL) |
n/a | :personaladexamples.com US:search.biduplinks.co.uk US:search.smarturl.co.uk :search.homecinemasoftware.com US:rc10.overture.com **:169.254.162.196:707 174.36.138.72:80 US:208.43.250.167:80 69.64.147.243:80 US:72.30.190.105:80 |
135 | pcap | raw alerts ruleset |
http 266 lines |
Argh : 0.3 profile |
none | summary tarball |
0 of 42 | 574d3d0fdd NEW |
none[none] | none:none |
none|none | none | none |
| T:18:53:00 | Win2K-f | 78.186.239.226 (TTNET.NET.TR): TT ADSL-HUWAEI TTNET STATIC_ACI, ISTANBUL, ISTANBUL, TR. (DSL) |
n/a | :gardenlens.com :xz.ub9.net :placeapartments.info US:apartmentsbeach.net NL:as.casalemedia.com :images.ddc.com :s7.addthis.com US:domdex.com :b.collective-media.net :a.collective-media.net 173.45.105.218:8392 67.228.101.130:80 |
135 | pcap | raw alerts ruleset |
http 57 lines |
Argh : 0.3 profile |
none | summary tarball |
0 of 42 | e3fed78589 NEW |
none[none] | none:none |
none|none | none | none |
| T:19:03:00 | WinXP | 174.6.21.151 (SHAWCABLE.NET): SHAW COMMUNICATIONS INC, WINNIPEG, MANITOBA, CA. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 76 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 NEW a08f3b74a4 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:19:05:00 | Win2K-f | 174.0.4.183 (KODIAKPETROLEUM.COM): SHAW COMMUNICATIONS INC, CALGARY, ALBERTA, CA. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 222 lines |
Yeah : 1.3 profile |
none | summary tarball |
37 of 41 38 of 41 |
4180c19d91 NEW b6e91e001c NEW |
9f3f2de385 [0] d2275a6cf5[0] |
none:none none:none |
Armadillo| PolyEnE| |
none none |
trace trace |
| T:19:53:00 | WinXP | 71.113.168.178 (VERIZON.NET): VERIZON INTERNET SERVICES INC, BLOOMINGTON, ILLINOIS, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 NEW a08f3b74a4 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:21:46:00 | WinXP | 63.17.139.151 (UU.NET): UUNET TECHNOLOGIES INC, CLARKSTON, GEORGIA, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 133 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 8 of 33 |
53bfe15e91 NEW b7082104e4 NEW |
1473091351 [0] c5b49e7b82[0] |
ASM:Graph ASM:Graph |
tElock| tElock| |
lines=75 embedded dns lines=41 |
trace trace |